CVE-2008-0577

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

1.17%

Published

Feb 5, 2008

Modified

Jun 16, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

The Project Issue Tracking module 5.x-2.x-dev before 20080130 in the 5.x-2.x series, 5.x-1.2 and earlier in the 5.x-1.x series, 4.7.x-2.6 and earlier in the 4.7.x-2.x series, and 4.7.x-1.6 and earlier in the 4.7.x-1.x series for Drupal (1) does not restrict the extensions of attached files when the Upload module is enabled for issue nodes, which allows remote attackers to upload and possibly execute arbitrary files; and (2) accepts the .html extension within the bundled file-upload functionality, which allows remote attackers to upload files containing arbitrary web script or HTML.

Weaknesses (CWE)

CWE-264

Affected Products (2)

drupal · project_issue_tracking_modulevulnerable

References (6)

http://drupal.org/node/216063

http://secunia.com/advisories/28731

Vendor Advisory

http://www.vupen.com/english/advisories/2008/0376/references

http://drupal.org/node/216063

http://secunia.com/advisories/28731

Vendor Advisory

http://www.vupen.com/english/advisories/2008/0376/references

KEV Catalog EPSS Scores Vendors All CVEs